我有一个静态的HTML网站，由Apache 2.4使用SSI服务。 我一直在使用基本身份validation来控制对文件子集的访问，并且已经停止了预期的行为。 基本上我想要做的就是要求网站的某些部分的用户名/密码。 我已经包含了我认为是相关的configuration，更改了一些名称以保护隐私。
/etc/apache2/sites-enabled/example.conf
<VirtualHost *:80> ServerName site.example.com:80 ServerAdmin webmaster@localhost DocumentRoot /var/www/site <Directory /var/www/site/> Options Includes Indexes FollowSymLinks MultiViews AllowOverride All Require all granted </Directory> ErrorLog /var/log/apache2/error.log </VirtualHost> /var/www/site/.htaccess
AuthType Basic AuthName "Site Access Control" AuthBasicProvider file AuthUserFile /var/www/site/passwords
/var/www/site/dir1/dir2/protected-dir/.htaccess
require valid-user
据我了解，我已经configuration了我的虚拟主机的网站目录。 在顶层目录中，我configuration了基本authentication。 在那些我希望控制访问的目录中，我需要一个有效的用户。 .htaccess文件应该相应地组合。
当我浏览到：
site.example.com/dir1/dir2/protected-dir
我被授予访问该页面，其内容是可见的。 这不是我所期望的。 在Apache2错误日志中，我得到以下内容：
[Sat Jul 04 11:03:12.073970 2015] [deflate:debug] [pid 19576] mod_deflate.c(855): [client 192.168.50.242:63254] AH01384: Zlib: Compressed 3036 to 656 : URL /dir1/dir2/protected-dir/index.shtml, referer: http://site.example.com/dir1/dir2/ [Sat Jul 04 11:03:12.095014 2015] [authz_core:debug] [pid 19576] mod_authz_core.c(802): [client 192.168.50.242:63254] AH01626: authorization result of Require valid-user : denied (no authenticated user yet), referer: http://site.example.com/dir1/dir2/protected-dir/ [Sat Jul 04 11:03:12.095044 2015] [authz_core:debug] [pid 19576] mod_authz_core.c(802): [client 192.168.50.242:63254] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet), referer: http://site.example.com/dir1/dir2/protected-dir/ [Sat Jul 04 11:03:12.095721 2015] [authz_core:debug] [pid 19576] mod_authz_core.c(802): [client 192.168.50.242:63254] AH01626: authorization result of Require valid-user : granted, referer: http://site.example.com/dir1/dir2/protected-dir/ [Sat Jul 04 11:03:12.095741 2015] [authz_core:debug] [pid 19576] mod_authz_core.c(802): [client 192.168.50.242:63254] AH01626: authorization result of <RequireAny>: granted, referer: http://site.example.com/dir1/dir2/protected-dir/ [Sat Jul 04 11:03:12.095994 2015] [deflate:debug] [pid 19576] mod_deflate.c(855): [client 192.168.50.242:63254] AH01384: Zlib: Compressed 1397 to 481 : URL /dir1/dir2/protected-dir/style.css, referer: http://site.example.com/dir1/dir2/protected-dir/
你能确定我的configuration有什么问题吗？
I am granted access to the page and its contents are visible. This is not what I expect. 但是，该configuration包含Require all granted因此预计可以访问页面及其内容。
说明
要求全部
The all provider mimics the functionality that was previously provided by the 'Allow from all' and 'Deny from all' directives. This provider can take one of two arguments which are 'granted' or 'denied'. The following examples will grant or deny access to all requests. Require all granted Require all denied
如何解决这个问题
你可以使用mod_authn_core
创build身份validation提供程序别名
Extended authentication providers can be created within the configuration file and assigned an alias name. The alias providers can then be referenced through the directives AuthBasicProvider or AuthDigestProvider in the same way as a base authentication provider. Besides the ability to create and alias an extended provider, it also allows the same extended authentication provider to be reference by multiple locations. Examples This example checks for passwords in two different text files. Checking multiple text password files # Check here first <AuthnProviderAlias file file1> AuthUserFile "/www/conf/passwords1" </AuthnProviderAlias> # Then check here <AuthnProviderAlias file file2> AuthUserFile "/www/conf/passwords2" </AuthnProviderAlias> <Directory "/var/web/pages/secure"> AuthBasicProvider file1 file2 AuthType Basic AuthName "Protected Area" Require valid-user </Directory>
基于另一个答案，我发现将两个.htaccess文件合并为一个，并将其放在我希望保护的目录中。 这是最后的文件：
AuthType Basic AuthName "Site Access Control" AuthBasicProvider file AuthUserFile /var/www/site/passwords require valid-user